Same text, different authority: the reserved-token experiment in AI prompt injection

A paper titled "Byte Authority" found that the same forged dialogue marker, when sent encoded as reserved tokens, is easier to use to break AI agents than when split into ordinary subwords. On Llama-3.1-8B, the prompt injection success rate was 98.2% with reserved tokens, dropping to 39.7% after splitting, below the 51.6% for plain-text injection; the reserved-token identity effect reached 39 to 66 percentage points across three models: Llama-3.1, GLM-4.5 and Seed-OSS-36B. Qwen3-8B showed a gap of only 8.1 percentage points because it generates a thinking process; after forcibly disabling thinking, the gap rose to 49.8 percentage points. The researchers tested Qwen3-8B, Llama-3.1-8B, GLM-4.5 and Seed-OSS-36B on InjecAgent and AgentDojo, and found that among the 400 most-downloaded dialogue models, 33 tokenizer configurations did not include tool protocol tokens in their splitting defenses.